mixdog 0.9.63 → 0.9.65

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -25,6 +25,7 @@ import {
 
 // Human-readable transport label for handshake/acquire error messages. Shared
 // with openai-oauth-ws.mjs (stream-side errors use the same labels).
+import { _envOn, _codexUuidIdParity, _codexDashedId, _codexTurnStateGate, _codexDashedIdV7, _codexBetaFeatures, _dumpHandshakeHeaders, _dumpFrame, _cfCookieHeader, _cfCookieCapture } from './openai-ws-headers.mjs';
 export function _wsErrLabel(p) {
     if (p === 'xai') return 'xAI WS';
     if (p === 'openai-direct' || p === 'openai') return 'OpenAI WS';
@@ -68,7 +69,7 @@ const MAX_POOLED_SOCKETS_PER_KEY = 8;
 // Entry: { socket, busy, idleTimer, lastResponseId, lastRequestSansInput,
 //          lastRequestInput, lastResponseItems, lastInputLen, turnState,
 //          closing, ephemeral }
-const _wsPool = new Map();
+export const _wsPool = new Map();
 let _releaseSequence = 0;
 
 function _poolCompatibility(auth, cacheKey) {
@@ -119,193 +120,6 @@ function _selectIdleEntry(entries, compatibility) {
 //                                  (opencode request.ts:187, ws-pool.ts:66)
 //   MIXDOG_OAI_WS_URL_SESSION=0    drop the ?session_id= URL query (codex/pi/
 //                                  opencode all use the bare WS URL)
-const _cfCookieJar = new Map(); // accountKey -> { name -> value }
-const _CF_COOKIE_ALLOWLIST = new Set(['__cf_bm', '_cfuvid']);
-
-function _envOn(name) {
-    const v = String(process.env[name] || '').trim().toLowerCase();
-    return ['1', 'true', 'yes', 'on'].includes(v);
-}
-
-// --- Opt-in Codex fingerprint/id parity knobs ------------------------------
-// All default OFF; unset envs leave the winning combo
-// (MIXDOG_OAI_CODEX_WIRE_PARITY=1 + ws-delta + underscore session_id) exactly
-// as-is. These add EXTRA parity dimensions for backend fingerprint probes.
-
-// codex sends dashed RFC-4122 UUIDs as session-id/thread-id (client.rs:1033-
-// 1057); we key those dashed handshake headers off the underscore cacheKey by
-// default. Opt in with MIXDOG_OAI_CODEX_WIRE_PARITY_UUID_IDS to reshape ONLY
-// the dashed pair (session-id/thread-id/x-client-request-id) into codex's UUID
-// format. The value is derived deterministically from the id so it stays
-// stable per cache key (prefix-cache continuity preserved), and the underscore
-// `session_id` header (the backend prefix-dedupe key) is left untouched.
-function _codexUuidIdParity() {
-    const v = String(process.env.MIXDOG_OAI_CODEX_WIRE_PARITY_UUID_IDS || '').trim().toLowerCase();
-    return ['1', 'true', 'yes', 'on', 'uuid', 'dashed'].includes(v);
-}
-
-function _codexDashedId(value) {
-    const h = createHash('sha256').update(String(value)).digest();
-    const b = Buffer.from(h.subarray(0, 16));
-    b[6] = (b[6] & 0x0f) | 0x50; // version 5 nibble
-    b[8] = (b[8] & 0x3f) | 0x80; // RFC-4122 variant
-    const hex = b.toString('hex');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
-// Opt-in turn-state gate experiment bundle (MIXDOG_OAI_CODEX_TURN_STATE_GATE).
-// The debugger's working hypothesis for what gates x-codex-turn-state issuance
-// is a specific wire shape: Codex-shaped UUIDv7 session/thread ids + dashed-only
-// handshake headers (drop the underscore session_id) + NO duplicated
-// x-client-request-id + a parent-thread header (added in openai-oauth-ws.mjs).
-// This env ties those dimensions together as ONE experiment so operators can
-// A/B the whole gate shape without hand-composing four flags. Default OFF; it
-// leaves MIXDOG_OAI_CODEX_WIRE_PARITY_UUID_IDS / _SESSION_ID and every existing
-// flag intact and only reshapes the wire when explicitly enabled.
-function _codexTurnStateGate() {
-    const v = String(process.env.MIXDOG_OAI_CODEX_TURN_STATE_GATE || '').trim().toLowerCase();
-    return ['1', 'true', 'yes', 'on'].includes(v);
-}
-
-// Same derivation as _codexDashedId but stamps the version-7 nibble so the
-// dashed pair reads as a Codex-shaped UUIDv7. Deterministic per id (prefix
-// cache continuity preserved); only used under the turn-state gate bundle.
-function _codexDashedIdV7(value) {
-    const h = createHash('sha256').update(String(value)).digest();
-    const b = Buffer.from(h.subarray(0, 16));
-    b[6] = (b[6] & 0x0f) | 0x70; // version 7 nibble
-    b[8] = (b[8] & 0x3f) | 0x80; // RFC-4122 variant
-    const hex = b.toString('hex');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
-// codex advertises enabled beta features on the WS handshake; the backend
-// plausibly gates x-codex-turn-state issuance on that list (see the
-// x-codex-beta-features comment below). MIXDOG_CODEX_BETA_FEATURES replaces the
-// whole list; MIXDOG_OAI_CODEX_TURN_STATE_FEATURES is a safe ADD-ONLY opt-in
-// that appends turn-state-gating feature token(s) (comma-separated, de-duped)
-// without dropping the default `remote_compaction_v2`. Unset = default list.
-function _codexBetaFeatures() {
-    const base = process.env.MIXDOG_CODEX_BETA_FEATURES || 'remote_compaction_v2';
-    const extra = String(process.env.MIXDOG_OAI_CODEX_TURN_STATE_FEATURES || '').trim();
-    if (!extra) return base;
-    const seen = new Set();
-    const out = [];
-    for (const tok of `${base},${extra}`.split(',').map((s) => s.trim()).filter(Boolean)) {
-        if (seen.has(tok)) continue;
-        seen.add(tok);
-        out.push(tok);
-    }
-    return out.join(',');
-}
-
-// --- Opt-in raw WS capture for byte-diff against codex-rs -------------------
-// Enabled ONLY when MIXDOG_OAI_WS_DUMP_DIR names a directory. Persists the
-// (redacted) handshake header metadata and the exact serialized
-// response.create frame bytes so our wire format can be byte-diffed against
-// codex. Secrets (Authorization / Cookie / account-id / routing tokens) are
-// hashed, never written in clear. When the env is unset both helpers are
-// no-ops, so there is no default behavior change.
-const _WS_DUMP_SECRET_RE = /^(authorization|proxy-authorization|cookie|set-cookie|chatgpt-account-id|x-codex-turn-state|session_id|session-id|thread-id|x-codex-parent-thread-id|x-client-request-id|x-session-affinity)$/i;
-
-function _wsDumpDir() {
-    const dir = String(process.env.MIXDOG_OAI_WS_DUMP_DIR || '').trim();
-    return dir || null;
-}
-
-function _redactHeaderValue(key, value) {
-    const v = String(value ?? '');
-    if (_WS_DUMP_SECRET_RE.test(String(key))) {
-        if (!v) return '';
-        return `<redacted:sha256:${createHash('sha256').update(v).digest('hex').slice(0, 12)}:len${v.length}>`;
-    }
-    return v;
-}
-
-function _redactDumpUrl(url) {
-    try {
-        const parsed = new URL(String(url));
-        for (const [key, value] of parsed.searchParams.entries()) {
-            if (_WS_DUMP_SECRET_RE.test(String(key))) {
-                parsed.searchParams.set(key, _redactHeaderValue(key, value));
-            }
-        }
-        return parsed.toString();
-    } catch {
-        return String(url || '');
-    }
-}
-
-function _dumpHandshakeHeaders(url, headers) {
-    const dir = _wsDumpDir();
-    if (!dir) return;
-    try {
-        mkdirSync(dir, { recursive: true });
-        const redacted = {};
-        for (const [k, v] of Object.entries(headers || {})) redacted[k] = _redactHeaderValue(k, v);
-        const rec = {
-            ts: new Date().toISOString(),
-            kind: 'ws_handshake',
-            url: _redactDumpUrl(url),
-            // Header order matters for the codex byte-diff; keep it explicit.
-            headerOrder: Object.keys(headers || {}),
-            headers: redacted,
-        };
-        const stamp = `${Date.now()}-${randomBytes(4).toString('hex')}`;
-        writeFileSync(join(dir, `handshake-${stamp}.json`), JSON.stringify(rec, null, 2));
-    } catch {}
-}
-
-function _dumpFrame(payload) {
-    const dir = _wsDumpDir();
-    if (!dir) return;
-    try {
-        mkdirSync(dir, { recursive: true });
-        const stamp = `${Date.now()}-${randomBytes(4).toString('hex')}`;
-        // Persist the serialized response.create bytes for codex byte-diff,
-        // but never dump x-codex-turn-state in clear. That token is a
-        // per-turn credential-like routing secret; header dumps already hash
-        // it, so frame dumps must do the same when client_metadata carries it.
-        let out = payload;
-        try {
-            const frame = JSON.parse(String(payload));
-            const meta = frame?.client_metadata;
-            if (meta && typeof meta === 'object' && typeof meta['x-codex-turn-state'] === 'string') {
-                meta['x-codex-turn-state'] = _redactHeaderValue('x-codex-turn-state', meta['x-codex-turn-state']);
-                out = JSON.stringify(frame);
-            }
-        } catch {}
-        writeFileSync(join(dir, `frame-${stamp}.json`), out);
-    } catch {}
-}
-
-function _cfCookieAccountKey(auth) {
-    return String(auth?.account_id || auth?.apiKey || 'default');
-}
-
-function _cfCookieHeader(auth) {
-    if (!_envOn('MIXDOG_OAI_CF_COOKIES')) return null;
-    const jar = _cfCookieJar.get(_cfCookieAccountKey(auth));
-    if (!jar || !jar.size) return null;
-    return [...jar.entries()].map(([k, v]) => `${k}=${v}`).join('; ');
-}
-
-function _cfCookieCapture(auth, setCookieHeaders) {
-    if (!_envOn('MIXDOG_OAI_CF_COOKIES')) return;
-    const list = Array.isArray(setCookieHeaders) ? setCookieHeaders : (setCookieHeaders ? [setCookieHeaders] : []);
-    if (!list.length) return;
-    const key = _cfCookieAccountKey(auth);
-    let jar = _cfCookieJar.get(key);
-    if (!jar) { jar = new Map(); _cfCookieJar.set(key, jar); }
-    for (const raw of list) {
-        const pair = String(raw || '').split(';', 1)[0];
-        const eq = pair.indexOf('=');
-        if (eq <= 0) continue;
-        const name = pair.slice(0, eq).trim();
-        if (_CF_COOKIE_ALLOWLIST.has(name)) jar.set(name, pair.slice(eq + 1).trim());
-    }
-}
-
 function _getPoolArr(poolKey) {
     if (!poolKey) return null;
     let arr = _wsPool.get(poolKey);

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -85,7 +85,7 @@ export {
 // inter-chunk / reasoning span keeps the longer deadlines below.
 // Positive-int coercion for per-call timeout overrides: finite > 0 → floor,
 // else fallback.
-export function _positiveInt(value, fallback = 0) {
+function _positiveInt(value, fallback = 0) {
     const n = Number(value);
     return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
 }
@@ -102,7 +102,7 @@ export const WS_INTER_CHUNK_MS = PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS;
 // The ws library has already assembled the Buffer by this point, so this check
 // must stay before data.toString() below. xAI shares this stream implementation
 // but retains its existing unbounded behavior.
-export const OPENAI_WS_MAX_INCOMING_FRAME_BYTES = 16 * 1024 * 1024;
+const OPENAI_WS_MAX_INCOMING_FRAME_BYTES = 16 * 1024 * 1024;
 const X_CODEX_TURN_STATE_HEADER = 'x-codex-turn-state';
 const WS_TRACE_ENABLED = process.env.MIXDOG_WS_TRACE === '1';
 

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -31,12 +31,12 @@ const OPENAI_DIRECT_PRIORITY_MODEL_PATTERNS = Object.freeze([
     /^gpt-5\.4-mini(?:-\d{4}|$)/,
 ]);
 
-export function openAiDirectSupportsPriority(model) {
+function openAiDirectSupportsPriority(model) {
     const id = String(model || '').trim();
     return OPENAI_DIRECT_PRIORITY_MODEL_PATTERNS.some(re => re.test(id));
 }
 
-export function applyOpenAIDirectFastTier(body, model, opts) {
+function applyOpenAIDirectFastTier(body, model, opts) {
     if (opts?.fast === true && openAiDirectSupportsPriority(model)) {
         body.service_tier = 'priority';
     }

package/src/runtime/agent/orchestrator/providers/opencode-go.mjs

@@ -41,7 +41,7 @@ export function openCodeGoEndpointForModel(model, configuredBaseURL) {
         : `${bases.openai}/chat/completions`;
 }
 
-export function normalizeOpenCodeGoResultUsage(result, anthropicRoute) {
+function normalizeOpenCodeGoResultUsage(result, anthropicRoute) {
     if (!anthropicRoute || !result?.usage) return result;
     const usage = result.usage;
     const input = Number(usage.inputTokens) || 0;

package/src/runtime/agent/orchestrator/providers/provider-catalog-cache.mjs

@@ -44,7 +44,7 @@ function rowId(row) {
   return String(row?.id || row?.name || row?.slug || '').trim();
 }
 
-export function getProviderCachedModelSync(provider, model) {
+function getProviderCachedModelSync(provider, model) {
   const p = String(provider || '').toLowerCase();
   const files = PROVIDER_CACHE_FILES[p] || [];
   if (!files.length || !model) return null;

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -316,7 +316,7 @@ export function _withLoadedProviderCtorForTest(name, Ctor, fn) {
 // agent.init() after providers are registered so the first agent dispatch call
 // (e.g. cycle1 on session start) does not pay the catalog refresh latency
 // inline. Fire-and-forget: failures are logged inside each provider.
-export function warmupCatalogs() {
+function warmupCatalogs() {
     const metadataReady = Promise.resolve()
         .then(() => warmModelMetadataCatalogs())
         .catch((err) => {

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -274,7 +274,7 @@ function isPermanentQuotaError(err) {
  * oauth's MAX_ATTEMPTS, openai-oauth-ws's mid-stream classifier) still gate
  * on attempt count separately; this helper only answers the kind question.
  */
-export function isRetryable(err) {
+function isRetryable(err) {
   return classifyError(err) === 'transient'
 }
 
@@ -304,7 +304,7 @@ export function anthropicRequestTimeoutMs() {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 600_000
 }
 
-export const ANTHROPIC_MAX_CONSECUTIVE_529 = 3
+const ANTHROPIC_MAX_CONSECUTIVE_529 = 3
 
 export class AnthropicFallbackTriggeredError extends Error {
   constructor(originalModel, fallbackModel, cause) {

package/src/runtime/agent/orchestrator/providers/statusline-route-meta.mjs

@@ -19,7 +19,7 @@ async function loadRouteMetaModule() {
 }
 
 /** Await before calling the sync exports when route-meta may not be ready yet. */
-export async function ensureStatuslineRouteMetaLoaded() {
+async function ensureStatuslineRouteMetaLoaded() {
   return loadRouteMetaModule();
 }
 

package/src/runtime/agent/orchestrator/session/cache/prefetch-cache.mjs

@@ -131,7 +131,7 @@ export function invalidatePrefetchCache(path, cwd) {
     _deleteDiskEntry(abs);
 }
 
-export function drainPrefetchDiskWrites() {
+function drainPrefetchDiskWrites() {
     if (_diskWriteTimer !== null) {
         clearTimeout(_diskWriteTimer);
         _diskWriteTimer = null;

package/src/runtime/agent/orchestrator/session/cache/scoped-cache.mjs

@@ -326,7 +326,7 @@ export function clearScopedCounters(sessionId) {
  * Configure the data directory for snapshot writes. Must be called once at
  * startup. Safe to call repeatedly.
  */
-export function configureCacheStatsSnapshot(dataDir) {
+function configureCacheStatsSnapshot(dataDir) {
     _snapshotDataDir = typeof dataDir === 'string' && dataDir.length > 0 ? dataDir : null;
 }
 
@@ -334,7 +334,7 @@ export function configureCacheStatsSnapshot(dataDir) {
  * Aggregate all live session counters into totals + per-session breakdown.
  * Pure computation — no I/O. Exported for tests.
  */
-export function aggregateCacheStats() {
+function aggregateCacheStats() {
     const totals = { sets: 0, hits: 0, misses: 0, clears: 0 };
     const perSession = [];
     for (const [sessionId, c] of _scopedCounters) {
@@ -379,7 +379,7 @@ function _scheduleCacheStatsFlush() {
 }
 
 /** Sync-flush pending cache-stats snapshot on exit. */
-export function drainCacheStats() {
+function drainCacheStats() {
     if (_snapshotTimer === null) return;
     clearTimeout(_snapshotTimer);
     _snapshotTimer = null;

package/src/runtime/agent/orchestrator/session/compact/budget.mjs

@@ -36,8 +36,8 @@ const PRUNE_TOOL_OUTPUT_MAX_CHARS = 2_000;
 const PRUNE_TOOL_OUTPUT_HEAD_CHARS = 1_000;
 const PRUNE_TOOL_OUTPUT_TAIL_CHARS = 600;
 const PRUNE_TAIL_TURNS = 2;
-export const MIN_PRESERVE_RECENT_TOKENS = 2_000;
-export const PRESERVED_FACTS_MAX_CHARS = 600;
+const MIN_PRESERVE_RECENT_TOKENS = 2_000;
+const PRESERVED_FACTS_MAX_CHARS = 600;
 
 function preservedFactHints() {
     return String(process.env.MIXDOG_COMPACT_FACT_HINTS || '')

package/src/runtime/agent/orchestrator/session/compact/file-reattach.mjs

@@ -13,7 +13,7 @@ import { isAbsolute, resolve as resolvePath } from 'node:path';
 import { estimateTokens } from '../context-utils.mjs';
 
 export const MAX_REATTACH_FILES = 3;
-export const REATTACH_MAX_TOKENS_PER_FILE = 5_000;
+const REATTACH_MAX_TOKENS_PER_FILE = 5_000;
 export const REATTACH_MAX_TOTAL_TOKENS = 8_000;
 const REATTACH_MIN_ROOM_TOKENS = 1_024;
 const REATTACH_MAX_FILE_BYTES = 512 * 1024;
@@ -41,7 +41,7 @@ function pathsFromReadArgs(rawArgs) {
 }
 
 // Ordered (oldest -> newest) file paths read via the `read` tool in `messages`.
-export function collectReadToolPaths(messages) {
+function collectReadToolPaths(messages) {
     const out = [];
     for (const m of Array.isArray(messages) ? messages : []) {
         if (m?.role !== 'assistant' || !Array.isArray(m.toolCalls)) continue;

package/src/runtime/agent/orchestrator/session/compact/summary-schema.mjs

@@ -45,7 +45,7 @@ function summaryHeadingLines(summary) {
 // Preferences` satisfy the `## Constraints` anchor while NOT letting an
 // unrelated `## Goalkeeper` heading satisfy `## Goal`. Requires a real `## `
 // heading line (not a substring buried in prose).
-export function headingMatchesAnchor(heading, anchor) {
+function headingMatchesAnchor(heading, anchor) {
     const anchorTitle = anchor.replace(/^##\s+/, '').trim().toLowerCase();
     const headingTitle = heading.replace(/^##\s+/, '').trim().toLowerCase();
     if (headingTitle === anchorTitle) return true;

package/src/runtime/agent/orchestrator/session/compact/summary.mjs

@@ -90,7 +90,7 @@ function transcriptLineForCompaction(m, index, perMessageChars) {
     return `${index + 1}. ${role}${meta}:\n${text}`;
 }
 
-export function buildCompactionPrompt({ head, previousSummary, preservedFacts }, perMessageChars) {
+function buildCompactionPrompt({ head, previousSummary, preservedFacts }, perMessageChars) {
     const lines = [
         previousSummary
             ? 'Update the anchored summary below using the conversation history that follows. Preserve still-true details, remove stale details, and merge in the new facts.'

package/src/runtime/agent/orchestrator/session/compact/text-utils.mjs

@@ -6,9 +6,9 @@ import { estimateMessagesTokens } from '../context-utils.mjs';
 const TOOL_ARG_STRING_MAX_CHARS = 360;
 const TOOL_ARG_ARRAY_MAX_ITEMS = 8;
 const TOOL_ARG_MAX_DEPTH = 4;
-export const TOOL_CALL_ARGS_MAX_CHARS = 260;
+const TOOL_CALL_ARGS_MAX_CHARS = 260;
 export const TOOL_CALL_FACT_ARGS_MAX_CHARS = 140;
-export const TOOL_CALLS_MAX = 4;
+const TOOL_CALLS_MAX = 4;
 const SENSITIVE_TOOL_ARG_KEY_RE = /(?:^|[_-])(?:api[_-]?key|authorization|auth|cookie|credential|passwd|password|refresh[_-]?token|secret|token)(?:$|[_-])/i;
 // Word alternation for raw-string (non-JSON) secret redaction. Mirrors the
 // keys in SENSITIVE_TOOL_ARG_KEY_RE and the session-ingest redactor so a raw

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -28,7 +28,7 @@ export {
 // Token estimation: real o200k_base BPE (tiktoken) + per-provider calibration.
 //
 // estimateTokens() encodes the provider-visible text projection with the real
-// o200k_base BPE (tiktoken, same approach as Roo Code / goose / chatbox), so
+// o200k_base BPE (tiktoken, same approach as mainstream agent UIs), so
 // estimates track actual billing instead of a weighted-chars heuristic that
 // diverged -25%..+60% depending on script and provider. The residual
 // provider-specific gap between an o200k count and billed prompt tokens is
@@ -71,7 +71,7 @@ function bpeEncoder() {
 
 // Compaction budget loops re-estimate overlapping transcript slices; identical
 // large strings (tool results, system blocks) would re-encode every pass.
-// Hash-keyed LRU (goose token_counter.rs pattern) absorbs the repeats.
+// Hash-keyed LRU absorbs the repeats.
 const TOKEN_COUNT_CACHE_MIN_CHARS = 512;
 const TOKEN_COUNT_CACHE_MAX_ENTRIES = 1_024;
 const tokenCountCache = new Map();
@@ -283,7 +283,7 @@ function nativeBlocksEstimateText(value) {
         catch { return String(block ?? ''); }
     }).join('\n');
 }
-export function messageEstimateText(m) {
+function messageEstimateText(m) {
     if (!m || typeof m !== 'object') return '';
     // Multimodal image payloads remain on the live message for provider sends,
     // but their base64/data-url JSON is not text and must not dominate local
@@ -361,7 +361,7 @@ function messageFileAllowance(m) {
         Math.max(FILE_TOKEN_ALLOWANCE_FLOOR, Math.ceil((descriptor.sizeBytes || 0) / 16)),
     ), 0);
 }
-export function estimateMessageTokens(m) {
+function estimateMessageTokens(m) {
     return estimateTokens(messageEstimateText(m)) + messageImageAllowance(m) + messageFileAllowance(m) + 4;
 }
 export function estimateMessagesTokens(messages) {

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -31,7 +31,7 @@ export function isOnDeferredToolSurface(session, name) {
     return isActiveSessionTool(session, name) || lookupDeferredCatalogTool(session, name) !== null;
 }
 
-export function toolExecutesWhenInactive(name) {
+function toolExecutesWhenInactive(name) {
     return INACTIVE_INFRA_BYPASS.has(name);
 }
 

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -27,6 +27,20 @@ const WORKER_DENIED_TOOLS = new Set([
 ]);
 
 const IMAGE_PATH_RE = /\.(?:png|jpe?g|gif|webp)(?:$|[?#])/i;
+const COMPACTED_PATCH_LINE_RE = /^\s*\[mixdog compacted\b[^\]\n]*\]/;
+
+function hasCompactedPatchPlaceholder(call) {
+    if (call?.name !== 'apply_patch') return false;
+    const value = typeof call?.arguments === 'string'
+        ? call.arguments
+        : call?.arguments?.patch;
+    if (typeof value !== 'string') return false;
+    for (const line of value.split(/\r?\n/)) {
+        if (line.startsWith('+') || line.startsWith('-') || line.startsWith(' ')) continue;
+        if (COMPACTED_PATCH_LINE_RE.test(line)) return true;
+    }
+    return false;
+}
 
 function callUrls(call) {
     const value = call?.arguments?.url;
@@ -67,6 +81,9 @@ export function routeWebFetchCall(call) {
 function _preDispatchDeny(call, toolKind, sessionRef) {
     const name = call?.name;
     if (typeof name !== 'string' || !name) return null;
+    if (hasCompactedPatchPlaceholder(call)) {
+        return 'Error: [tool-input-validation] apply_patch received a compacted-history placeholder, not executable patch content. Re-read the current target files and submit a fresh full patch; do not replay or reconstruct the stored marker.';
+    }
     const _agentOwned = sessionRef?.scope?.startsWith?.('agent:')
         || isAgentOwner(sessionRef);
     const _controlPlaneTool = WORKER_DENIED_TOOLS.has(name);

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -14,7 +14,7 @@ export function steeringContentText(content) {
     return String(content ?? '');
 }
 
-export function normalizeSteeringEntry(entry) {
+function normalizeSteeringEntry(entry) {
     if (typeof entry === 'string') {
         const text = entry.trim();
         return text ? { content: text, text } : null;

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -1,7 +1,8 @@
 // Stored tool-call argument compaction/restoration, extracted from loop.mjs.
 // Long body/command args are truncated with a sha256-tagged head/tail preview
-// when persisted into assistant history; the FULL body of a single call can be
-// restored on retry (e.g. a failed edit) so the model sees the original patch.
+// when persisted into assistant history. Failed command/script calls may
+// restore their full text, but mutation bodies stay compacted so stale patches
+// cannot be replayed from history.
 import { createHash } from 'crypto';
 
 const STORED_TOOL_ARG_BODY_KEY_RE = /^(?:content|old_string|new_string|patch|rewrite)$/i;
@@ -23,8 +24,8 @@ function compactStoredToolArgString(value, key = '') {
     // apply_patch / edit inputs. Keeping a head/tail preview leaves real patch
     // fragments (a "*** Begin Patch" opening, diff lines) inside a SUCCESSFUL
     // history entry that the model can copy back verbatim as new tool input.
-    // Emit the marker ALONE for these keys so nothing copyable survives; a
-    // FAILED call still restores the full original via restoreToolCallBodyForId.
+    // Emit the marker ALONE for these keys so nothing copyable survives,
+    // including after a failed call.
     if (isBody) return marker;
     const head = value.slice(0, STORED_TOOL_ARG_PREVIEW_HEAD).replace(/\r\n/g, '\n');
     const tail = value.slice(-STORED_TOOL_ARG_PREVIEW_TAIL).replace(/\r\n/g, '\n');
@@ -57,21 +58,15 @@ export function compactToolCallsForHistory(calls) {
     });
 }
 
-// Restore the FULL body of ONE tool call inside a history assistant message
-// whose toolCalls were compacted at push time. Used for a failed edit call so
-// the model sees the original patch/old_string on retry instead of a
-// `[mixdog compacted …]` placeholder it cannot act on. Must run BEFORE the
-// message is first transmitted so it never mutates an already-cached prefix
-// (the prompt cache is content-prefix matched).
+// Restore retry-safe long command/script text for ONE failed tool call inside a
+// history assistant message whose toolCalls were compacted at push time.
+// Mutation bodies (patch, old_string, new_string, content, rewrite) deliberately
+// remain compacted: replaying their stale pre-failure text can repeat partial
+// writes or overwrite newer state. Must run BEFORE the message is first
+// transmitted so it never mutates an already-cached prefix.
 //
-// Only the compactable body/long keys (patch, old_string, new_string, content,
-// rewrite, command, script) are restored, and at ANY depth — compaction is
-// recursive (compactStoredToolArgValue), so batch shapes like edits[].old_string
-// or writes[].content carry nested compacted bodies too. Every other field
-// (e.g. `path`, which a tool may mutate in place during execution) is taken from
-// the compacted snapshot captured at push time, before any mutation. The
-// compacted args tree is built fresh by compactToolCallsForHistory and is not
-// shared with originalCalls, so rebuilding it here is safe.
+// Only command/script keys are restored, at ANY depth. Every body key and every
+// other field is taken from the compacted snapshot captured at push time.
 export function restoreToolCallBodyForId(assistantMsg, originalCalls, callId) {
     if (!assistantMsg || !Array.isArray(assistantMsg.toolCalls) || !callId) return;
     if (!Array.isArray(originalCalls)) return;
@@ -83,15 +78,12 @@ export function restoreToolCallBodyForId(assistantMsg, originalCalls, callId) {
     tc.arguments = _restoreCompactedBodies(tc.arguments, orig.arguments, '');
 }
 
-// Recursively rebuild a compacted args tree: replace ONLY compactable body/long
-// string fields (matched by key at any depth) with their full originals, and
-// keep every other field from the compacted snapshot. tcVal and origVal share
-// the same structure (compaction only shortens body strings), so the walk
-// descends them in parallel; a missing or non-object origVal falls back to the
-// compacted value rather than throwing.
+// Recursively rebuild a compacted args tree: replace ONLY retry-safe long
+// command/script fields with their full originals and keep mutation bodies plus
+// every other field from the compacted snapshot.
 function _restoreCompactedBodies(tcVal, origVal, key) {
-    if ((STORED_TOOL_ARG_BODY_KEY_RE.test(key) || STORED_TOOL_ARG_LONG_KEY_RE.test(key))
-        && typeof origVal === 'string') {
+    if (STORED_TOOL_ARG_BODY_KEY_RE.test(key)) return tcVal;
+    if (STORED_TOOL_ARG_LONG_KEY_RE.test(key) && typeof origVal === 'string') {
         return origVal;
     }
     if (Array.isArray(tcVal) && Array.isArray(origVal)) {

package/src/runtime/agent/orchestrator/session/loop/termination.mjs

@@ -15,7 +15,7 @@ export const INCOMPLETE_STOP_REASONS = new Set([
 // Gemini OTHER is intentionally opaque; neither is safe to treat as a token-cap
 // continuation. Compare case-insensitively so provider spelling variants do not
 // create a second policy.
-export const OUTPUT_LIMIT_STOP_REASONS = new Set([
+const OUTPUT_LIMIT_STOP_REASONS = new Set([
     'length', 'max_tokens', 'max_output_tokens',
 ]);
 

package/src/runtime/agent/orchestrator/session/loop/tool-classify.mjs

@@ -2,7 +2,7 @@
 // loop.mjs. These drive cross-turn read dedup, scoped caching, shell routing,
 // and duplicate-call detection. Strips the MCP prefix so direct calls and
 // MCP-wrapped calls share the same cache.
-export const MCP_TOOL_PREFIX = 'mcp__plugin_mixdog_mixdog__';
+const MCP_TOOL_PREFIX = 'mcp__plugin_mixdog_mixdog__';
 
 export function _stripMcpPrefix(name) {
     return typeof name === 'string' && name.startsWith(MCP_TOOL_PREFIX)
@@ -21,7 +21,7 @@ export function _isMutationTool(name) {
 // shell/bash_session, write/edit-style tools, and any (non-mixdog) MCP tool
 // whose effects are unknown. Kept separate from _isMutationTool, which stays
 // apply_patch-only for epoch-mutation counting and eager-dispatch gating.
-export const ORDERED_GATE_SAFE_READONLY_TOOLS = new Set([
+const ORDERED_GATE_SAFE_READONLY_TOOLS = new Set([
     'read',
     'find',
     'glob',
@@ -40,7 +40,7 @@ export const ORDERED_GATE_SAFE_READONLY_TOOLS = new Set([
 export function _isOrderedGateSkippable(name) {
     return !ORDERED_GATE_SAFE_READONLY_TOOLS.has(_stripMcpPrefix(name));
 }
-export const SCOPED_CACHEABLE_TOOLS = new Set([
+const SCOPED_CACHEABLE_TOOLS = new Set([
     'code_graph',
     'grep',
     'list',

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -24,6 +24,7 @@ import {
     semanticCompactionEnabledForSession,
     compactTypeForSession,
 } from './context-meta.mjs';
+import { resolveSemanticSummaryModel } from '../loop/compact-policy.mjs';
 import { uncachedInputTokensForProvider } from './usage-metrics.mjs';
 import { pruneOffloadSession } from '../tool-result-offload.mjs';
 import { _getPendingMessagesForSession } from './pending-messages.mjs';

package/src/runtime/agent/orchestrator/session/manager/context-meta.mjs

@@ -42,7 +42,7 @@ const CONTEXT_WINDOWS = {
 // (llama/mistral/phi/qwen/gemma) stay small so an unknown local id never claims
 // a giant window.
 const LOCAL_PROVIDERS = new Set(['ollama', 'lmstudio', 'llamacpp', 'llama.cpp', 'local', '']);
-export function guessContextWindow(model, provider = null) {
+function guessContextWindow(model, provider = null) {
     if (CONTEXT_WINDOWS[model])
         return CONTEXT_WINDOWS[model];
     const m = String(model || '').toLowerCase();

package/src/runtime/agent/orchestrator/session/manager/delivered-completions.mjs

@@ -31,7 +31,7 @@ const DELIVERED_MAX_ENTRIES = 512;
 // oldest key is always the first — used for bounded-size eviction.
 const _delivered = new Map();
 
-export function hashCompletionText(text) {
+function hashCompletionText(text) {
     const value = String(text ?? '').trim();
     if (!value) return null;
     return createHash('sha1').update(value).digest('hex');